Post #1539623
2025-11-17 13:50 UTC
@daandemeyer how does that work?
Replies (1)
-
@daandemeyer@mastodon.social 2025-11-17 13:55
@funkylab Instead of changing to root, we keep the current uid/gid and instead give it full ambient capabilities (https://man7.org/linux/man-pages/man7/capabilities.7.html). That's sufficient to pass all kernel privilege checks (disregarding LSMs). To pass polkit checks, we run the "run0 --empower" session with the new "empower" group as an auxiliary group and we ship a polkit rule to allow all actions for users in the "empower" group. Note that this won't work if a tool checks for uid 0 instead of capabilities.